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ABSTRACT OF THE DISCLOSURE 

Two or more access control lists that are syntactically or structurally different may be 
compared for functional or semantic equivalence in order to configure a security policy on a 
network. A first access control list is programmatically determined to be functionally 
equivalent to a second access control list for purpose of configuring or validating security 
policies on a network. In one embodiment, a box data representation facilitates comparing 
entries and sub-entries of the lists. 
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